Page MenuHomePhabricator

<nowiki> tags don't properly protect table-related content
Closed, ResolvedPublic

Description

$ echo -e '{|\n| style="background: <nowiki>\n\n\n\nred;</nowiki>" | hi\n|}' | php maintenance/parse.php 
<table>
<tr>
<td style="background: red;"> hi
</td></tr></table>

and

$ echo -e '{|\n| style="background: <nowiki>\n\n\n\nred;</nowiki>" | hi\n|}' | tests/parse.js  --normalize

<table>
<tbody>
<tr>
<td style="background: 



red;">hi</td>
</tr>
</tbody>
</table>

(note that the PHP sanitizer is removing the newlines, but that's not important)

But this breaks if the content is template affected. As arlo found:

(04:19:43 PM) arlolra: ah, i think i see what's going on
(04:19:44 PM) arlolra: https://github.com/wikimedia/parsoid/blob/master/lib/dom.t.TableFixups.js#L188-L190
(04:19:49 PM) arlolra: is just taking content
(04:20:08 PM) arlolra: and then reparsing it fails
(04:20:08 PM) arlolra: https://github.com/wikimedia/parsoid/blob/master/lib/dom.t.TableFixups.js#L267-L268
(04:20:12 PM) arlolra: from the newline

This is hard to demonstrate from the command-line, since you can't really coerce {{echo}} to emit a vertical bar in an appropriate way (if you use {{!}} inside echo it in effect gets interpreted *before* the arguments are passed to echo, so it separates the arguments to echo instead of being passed through to echo's output).

But parser tests will work:

!! article
Template:styletest
!! text
style="background: <nowiki>


red;</nowiki>" |
!! endarticle

!! test
T107622
!! wikitext
{|
| {{styletest}} hi
|}
!! html/php
<table>
<tr>
<td style="background: red;"> hi
</td></tr></table>
!! html/parsoid
<table>
<tbody>
<tr>
<td><span typeof="mw:Transclusion" data-mw='{"parts":[{"template":{"target":{"wt":"styletest","href":"./Template:Styletest"},"params":{},"i":0}}]}'>style="background: </span><span typeof="mw:Nowiki"> red;</span><span>" |</span> hi</td>
</tr>
</tbody>
</table>
!! end

Note the buggy html/parsoid output.

Note that the vertical bar needs to be inside the template to trigger the dom.t.TableFixups.js code, and thus the bug.

Event Timeline

cscott raised the priority of this task from to Medium.
cscott updated the task description. (Show Details)
cscott added a project: Parsoid.
cscott added subscribers: cscott, Arlolra.
cscott set Security to None.

Thanks for the test case!

Think I have a fix for this.

Change 228436 had a related patch set uploaded (by Arlolra):
<nowiki> tags don't properly protect table-related content

https://gerrit.wikimedia.org/r/228436

Change 228436 merged by jenkins-bot:
<nowiki> tags don't properly protect table-related content

https://gerrit.wikimedia.org/r/228436